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This paper describes the initial measured performance results of the previously 
documented NASA Langley Research Center (LaRC) Cockpit Motion Facility (CMF) 
motion base hardware safety devices. These safety systems are required to prevent excessive 
accelerations that could injure personnel and damage simulator cockpits or the motion base 
structure. Excessive accelerations may be caused by erroneous commands or hardware 
failures driving an actuator to the end of its travel at high velocity, stepping a servo valve, or 
instantly reversing servo direction. Such commands may result from single order failures of 
electrical or hydraulic components within the control system itself, or from aggressive or 
improper cueing commands from the host simulation computer. The safety systems must 
mitigate these high acceleration events while minimizing the negative performance impacts. 
The system accomplishes this by controlling the rate of change of valve signals to limit 
excessive commanded accelerations. It also aids hydraulic cushion performance by limiting 
valve command authority as the actuator approaches its end of travel. The design takes 
advantage of inherent motion base hydraulic characteristics to implement all safety features 
using hardware only solutions. 
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I. Introduction 

T HE NASA Langley Research Center (LaRC), Cockpit Motion Facility 1 (CMF) is comprised of a 76” stroke 
hydraulically actuated Stewart Platform motion base, three simulator cabs each of which can operate in either a 
fixed base site or located on the motion base platform, and a bridge crane used to move the cabs between their fixed 
base sites and the motion base. As with any motion base system, excessive accelerations could cause injury to 
personnel and possibly damage simulator cockpits or motion base structures. These accelerations may be caused by 
driving an actuator into the end of stroke at a high rate of velocity, stepping a servo valve open or closed, or 
commanding the instant reversal of a servo valve. These actions, whether erroneous or intentional, may be the result 
of a single order failure of electrical or hydraulic components within the control system itself or because of overly 
aggressive or poor cuing information from the host simulation computer. The safety systems must mitigate these 
high acceleration events while minimizing the negative performance impacts. The CMF control system designers 
utilized the inherent hydraulic characteristics of the motion base to implement safety features using only hardware 
solutions 2 . In the sections that follow, the initial measured performance results of several safety systems are 
presented. The first section briefly outlines each safety system and the configuration of the payload and key control 
system adjustments during the first phase of testing. The following sections illustrate the basic design and operation 
of each electronic safety system, describe the testing method used to evaluate them, and presents the initial measured 
results obtained from that test as well as any future testing or design changes that may be warranted. 

II. Safety Devices and System Configuration 

To mitigate the likelihood of an erroneous or intentional event causing one of the aforementioned excessive 
accelerations within the motion base system, the CMF control system designers determined that three main safety 
features would be needed; a velocity clamp to limit the velocity of a leg into the end of stroke, a rate limiter to limit 
accelerations caused by stepping or instantly reversing a servo valve, and finally an abort relay to limit actuator 
deceleration after an emergency stop or power failure. Since the manufacturer’s design of the motion base actuator 
employed a dual hydraulic valve, with each valve having 50 percent authority over the actuators operation, the 
system designers replicated the safety systems for each valve, providing a redundant level of safety for each leg. 

The accelerations induced by the safety devices during normal operations and during single order failures are a 
function of the maximum velocity which can be achieved by the actuators. The maximum velocity is in turn 
determined by system capability, the load seen by the actuator, key electrical adjustments of the servo electronics 
current amplifier gain and the mechanical adjustment of the servo valve spool stops. The gain of the current 
amplifiers, which drive the servo valves, directly affects the normal operating maximum position of the servo valve 
spool and therefore the maximum velocity of the actuator. The servo valves used in the CMF motion base employ 
adjustable spool stops which limit the maximum flow through the servo valve and therefore directly limit the 
maximum velocity of the actuators. The spool stops are adjusted so that during normal operations a 100% valve 
command will drive the spool very close (within 5%) to the spool stop. During single order failures the spool might 
be driven all the way to the spool stop. Finally, the maximum velocity is a function of the apparent mass seen by the 
actuator. For the initial test phase, the spool stops were set to limit hydraulic flow so that the maximum velocity of 
the actuator was slightly over 30 ips. The servo electronic current amplifier was set so that a 100% valve command 
would result in a 30 ips extension rate for the actuators. 

The first phase of motion base testing was performed without a test mass and the performance of all safety 
systems were assessed with the actuator velocity limited to 30 ips. In the follow-on second phase of testing, a test 
weight which simulates the mass and inertia of the heaviest simulator will be used. In this second phase, the 
maximum normal operating and single order failure accelerations will be determined. The safety devices and the 
allowable maximum velocity will be iteratively adjusted to achieve the maximum performance without exceeding 
the acceleration limits. The primary benefit of opening up the maximum velocity will be in the increased command 
authority which will improve the dynamic performance thereby increasing the frequency response of the motion 
base. 
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III. Performance of Safety Devices 


A. Velocity clamp (Valve command authority limit) performance 

1. Velocity Clamp Design 

The velocity clamp circuit limits the maximum servo valve command (which is directly related to steady state 
velocity) as a function of the measured leg length. The inputs to the circuit are the measured leg length and the servo 
valve command. The output of the circuit is a clamped servo valve command. As a leg approaches full extension or 
retraction, the safety hardware will limit the allowable velocity, by limiting the valve command, in the direction of 
the approaching hydraulic cushion at the ends of actuator stroke. The circuit does not limit velocity away from the 
cushion. While the motion base specifications allow for maximum leg accelerations slightly greater than 2Gs, the 
velocity clamp circuitry was designed to maximize the travel distance between the leg’s unattenuated extend and 
retract velocity clamp points without generating any acceleration in the leg greater than 1.5G over its entire travel 
envelope. Dynamic load modeling simulations were used to specify the velocity clamp breakpoints 3 . Knowing that 
the system dynamics of the motion base under actual operation would cause the velocity reductions near the ends of 
leg travel to lag the circuit’s valve current reductions, all clamp breakpoints are implemented to err on the side of 
conservativeness. The chosen design calls for a gradual reduction of the servo valve command by 25% starting when 
the legs reach an absolute distance of 27.3” and continuing until they reach 31.7” from their central standby position. 
Continuing from there, the maximum allowed servo valve command rapidly decreases from 75% to a maximum of 
3% when the legs reach an absolute distance of 34.5”. As the legs continue towards their mechanical ends of travel 
they remain limited to maximums of 3%. The notional diagram (see Figure 1) shows the shape of the velocity clamp 
envelope and gives an idea of the progression of tests used to map and verify its correct operation. The red and blue 
lines represent the boundaries of the velocity clamp. The blue shaded areas relate directly to velocity clamp testing, 
while the gray blocks show regions within the operational envelope that were tested for other reasons; such as 
verifying limit switch operations, analyzing hydraulic cushion responses, investigation of single order hydraulic or 
electrical failures and verifying computer operation control logic. 

Commanded Velocity Envelope 



Leg Extension (Inches) 

^“Allowed Extend Command "“Allowed Retract Command 


Figure 1 Notional plot of the velocity clamp envelope and areas tested. 
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2. Velocity Clamp Testing Method 

Testing of the circuit was accomplished by applying incrementally increasing DCL servo valve command inputs 
to each motion base leg in order to map the output velocity response of the system and verify its proper operation. 
Prior to each test run, an operator initialized the DCU function generators using the DVS interface to create an open 
loop, stepped valve command of specific amplitude 4 . The use of open loop commands allowed us the ability to 
isolate the performance of the velocity clamps from the effects of the valve controller. The open loop valve 
command input increments used in each of the single valve tests were 25, 50, 75 and 100 percent respectively and 
proper velocity clamp response was confirmed before moving to the next higher velocity. 

In order to assess and verify the operation each set of electronics, tests were first performed individually for each 
valve of the leg under observation (by electrically disconnecting the complementary servo valve) and then secondly 
to both leg valves in parallel. Because the servo valves are paired, the application of a 100% drive command while 
conducting tests utilizing only a single servo valve will produce a maximum obtainable velocity that is only 50% of 
the leg’s maximum velocity, whereas applying the same command with both servo valves connected allows the leg 
to operate at its full 100% maximum velocity. Only after individually confirming that each set of velocity clamp 
electronics were operational did we perform the dual valve tests that operate the leg up to its 1 00% maximum dual 
valve leg velocity. 

In the velocity clamp test, the motion base is initially commanded to transition all legs to a standby offset 
position. The leg under test is then driven open loop, at a specified velocity, into the end of actuator stroke. All 
motion base sensor data generated during each test is recorded and stored by the DVS computer. A Matlab script is 
used to post process the recorded data and generate an area of interest plot of the single valve response (see Figure 2 
and Figure 3). The lower left window shows the designed velocity clamp envelope, the normalized clamped 
command going into the servo amplifier (TP7), the normalized current through the servo valve (Isv) and the 
normalized velocity response. The upper left plot shows the calculated actuator velocity and measured acceleration 
as a function of leg position. The right plot shows the calculated velocity and measured acceleration as a function of 
time. Visual analysis of these raw data plots provides a quick method to confirm proper operation and performance 
of the velocity clamp circuitry and ensures that the acceleration did not exceed thresholds before proceeding to the 
next higher velocity. As seen in the sample single valve plot, the data obtained during one of the tests show that the 
velocity is indeed clamped (by means of limiting the command authority) near the ends of leg travel and that the 
maximum generated accelerations (decelerations) are 1.5G or less. The acceleration data, recorded from a linear 
accelerometer mounted on the moving end of the actuator under test, includes the gravitational and rotational 
components and no attempt is made to subtract their effects. 

In prior tests, the gain of each servo amplifier, along with its accompanying servo valve, was individually 
adjusted to provide a 10 inch per second (ips) leg extend velocity when a 65 percent closed loop drive command 
signal was applied, allowing us to target a maximum single valve extend leg velocity of 15 ips. The objective of this 
was to achieve a constant gain between the servo amplifier input and the leg velocity for all legs under the same load 
condition. For the dual valve configuration, the predicted maximum extend velocity would therefore be twice as 
much or 30ips. Since actuator geometries are different for the rod and cap ends of the piston, the retract velocities 
will be slightly slower than their extend counterparts. The plot also shows the expected tendency for the actuator 
velocity to lag slightly behind the authority design breakpoints. This is caused by system dynamics, whereas the 
slight differences between the slope of the design and actual clamp commands are due to a combination of minor 
misadjustments within the card during setup and the operational tolerances within the standard electronic 
components used during their construction. Since the maximum acceleration criteria used while designing the 
velocity clamps was very conservative, it is not critical that the outputs completely match the design profile, only 
that they match the trend and that generated accelerations remain below threshold. 
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Leg Velocity and Acceleration vs. Extension 


Leg Velocity and Acceleration vs. Time 





Figure 2 Sample retract velocity clamp and acceleration data obtained during single valve system testing. 


Leg Velocity and Acceleration vs. Extension 


Leg Velocity and Acceleration vs. Time 





Figure 3 Sample extend velocity clamp and acceleration data obtained during single valve system testing. 
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A similar Matlab script is used to post process the recorded dual valve data (see Figure 4 and Figure 5). As 
before, the lower left window shows the designed velocity clamp envelope and the normalized velocity response 
from the test, but now shows the normalized clamped command inputs to the servo amplifier (TP7) from both sets of 
electronics. The current through the servo valve (Isv) was evaluated previously and not recorded during the dual 
valve tests. The upper left plot now shows the filtered maximum actuator velocity and acceleration as a function of 
position, while the right plot shows the filtered velocity and accelerations as a function of time. Once again, a visual 
analysis of these raw data plots provide a quick method to confirm proper operation and performance of the velocity 
clamp circuitry and ensures that the acceleration did not exceed thresholds before proceeding to the next higher 
velocity. The velocity is still clamped (by means of limiting the command authority) near the ends of leg travel, with 
each circuit/ servo valve combination providing one half of the total leg control, and the maximum generated 
accelerations (decelerations) remain less than the designed 1.5G threshold. The dual valve plot now shows the 
velocities for the extend direction approaching the target leg maximum of 30ips, with retract velocities being slightly 
slower for the reasons mentioned earlier. The plot still shows the expected tendency for the actuator velocity to lag 
slightly behind the authority design breakpoints due to system dynamics. 


Leg Velocity and Acceleration vs. Extension Leg Velocity and Acceleration vs. Time 



Figure 4 Sample retract velocity clamp and acceleration data obtained during dual valve system testing. 
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Leg Velocity and Acceleration vs. Extension 



Leg Extension (in) 


DCL Command(Red), TP^(Cyan), TP7 2 (Blue), and Velocity(Green) vs. Extension 



Leg Extension (in) 


Leg Velocity and Acceleration vs. Time 



Figure 5 Sample extend velocity clamp and acceleration data obtained during dual valve system testing. 


After proper operation of the velocity clamp circuitry for every leg had been verified, tests were conducted 
to demonstrate a system response to a single order failure of the electronic or hydraulic system, A leg is commanded 
to drive towards the end of stroke while the motion base was operating under a range of velocities up to 100%. 
When the leg under test reaches a specified distance from the end of stroke, one of the leg’s valve pair was failed 
open in the direction of travel. The remaining valve’s control circuitry was not altered and continued to operate 
normally. To achieve this, an external test box was electrically inserted in-line with one of the two servo valves for 
the leg under test, effectively allowing the bypassing of one valve’s clamp circuitry. The test box was externally 
triggered by the DCU computer to isolate that valve from its control electronics when the leg reached a distance of 
25 inches in either direction from its center standby position. At that point, the test box inserted a signal that 
simulates an electronic or hydraulic failure and caused that valve to rail to its maximum. The plot (see Figure 6) 
shows the system response to the failure with the remaining valve’s velocity clamp still functional. The subplots on 
the left show the system response for the retract direction and the right subplots show the extend response. The 
lower subplots indicate the position where the simulated failure was initiated while the leg under test was 
commanded to the end of stroke at a specified velocity. The Isv signal of the operational valve follows the design 
profile as the valve command authority is reduced by its intact and operational velocity clamp circuitry. The failed 
valve’s Isv is not shown, but essentially becomes 100% in the direction of travel once the test circuitry is triggered. 
The valve command shows the control law’s attempt to maintain the specified velocity as the velocity clamp 
circuitry begins to limit the valve command of the remaining operational servo valve. The system ESTOPs when the 
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leg contacts a limit switch. The upper plots show that the remaining operational clamp circuitry still slows the leg’s 
velocity when approaching the end of travel, but only has 50% of total leg authority. 

Retract Leg Velocity vs. Retract Leg Position Extend Leg Velocity vs. Extend Leg Position 
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Figure 6 Velocity clamp data from servo valve fail-open testing. 


3. Velocity Clamp Future Tests/Changes 

Knowing that the results obtained during no-load testing will differ once a payload is added, these tests will be 
repeated with a test mass applied to the motion base that approximates the mass and inertial loading of a simulator 
cockpit. If the data obtained from those tests indicate that further velocity reductions are necessary, adjustments can 
be made and resistances used in the clamp circuitry can be easily modified to produce steeper clamp slopes. The 
velocity data presented in these plots (with the exception of the servo valve fail-open) was calculated from 
measured position data. We suffered a minor setback during our initial testing process when a leg position 
transducer failed. We took advantage of this by replacing the now discontinued, position only sensor with a newer 
model that provides velocity as well as position feedback outputs. This new hardware, which was not available for 
incorporation during the original control circuitry design, will eliminate the need to compute the leg velocities. 

As previously mentioned, the velocity clamps limit the velocity near the end of stroke by limiting the valve 
command as the actuator approaches the end of stroke. While the valve command is related to velocity, the two are 
not identical. The addition of a velocity sensor affords us the future option of using measured actuator velocity in the 
feedback loop of the servo valve current amplifier. By changing the valve amplifier to use velocity feedback, the 
servo electronics would directly control velocity which would be an improvement over the current configuration that 
controls command authority. This improvement will allow the servo electronics to compensate for load variations 
and allow better control over velocity near the ends of stroke, allowing an expanded motion base performance 
envelope. 
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B. Rate Limiter (Acceleration Command Limiter) 

1. Rate Limiter Design 

The COTS Servo Drive Module contains a ramp circuit that is useful in controlling the rate of change of a signal. 
The valve command, which is proportional to velocity (steady state), is passed through this circuit. Since the ramp 
limits the change of velocity command, it implements a hardware acceleration command limiter. The ramp rate of 
the limiter circuit is set at 8.1 milliseconds per volt to limit maximum commanded leg accelerations to 1.5G when 
measured in leg-space. The rate limiter design and function are described in “Mitigating Motion Base Safety Issues 
- The NASA LaRC CMF Implementation” 2 . 



Figure 7 Rate limiter data from software modeling (left) and bench testing (right). 

2. Rate Limiter Testing Method 

The rate limiters were individually tested for proper operation in conjunction with the single valve velocity 
clamp tests and a plot of the raw data appears in Figure 8. The red line represents the DCL command, the green 
line is the servo valve current (Isv) and the blue line is valve command (TP 7). The black line represents the 
slope of the designed rate limiter circuitry and is only used as a visual comparison reference and does not imply 
a time delay. 



Figure 8 Rate limiter data from system testing. 
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Figure 9 shows an enlarged area of interest for the rate limiter test data. The dotted black line that depicts 
the slope of the 8.1 millisecond per volt ramp design has been overlaid with the test data. As you can see for this 
particular card, the rate limited command has an 89.9 millisecond rise time for a full scale change in the applied 
signal. The figure also shows that while the digital control law applies some pre-limiting to the stepped command 
signal, it is less than the hardware output. Therefore it is the hardware that ultimately controls the ramp rate and 
limits the leg acceleration if an aggressive or stepped input is applied. 


DCL Command (Red) Isv (Green) and TP7 (Blue) vs. Time 
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Figure 9 Enlargement of rate limiter data obtained during system testing. 


3. Rate Limiter Future Tests/Changes 

The rate limiter circuitry is currently adjusted to provide a conservative limit on acceleration. This was desired 
during initial testing while the proper operation of controlling circuitry was being verified and we gained familiarity 
with the system’s operation. At the end of testing, with load applied and the final maximum velocity determined, we 
will revisit selection of the rate limit to see if the ramp duration can be decreased, allowing a higher bandwidth 
controller to drive the servo valves more aggressively. 


C. Abort Relay 

1. Abort Relay Design 

The safety function of the abort relay circuit is to limit actuator deceleration in the event of an ESTOP or power 
off condition. The abort relay performs this limiting using stored energy in the valve inductor and an abort capacitor 
to allow the valve current (Isv) to decay to zero when the drive signal is abruptly removed. The abort relay design 
and function are described in “Mitigating Motion Base Safety Issues - The NASA LaRC CMF Implementation” 2 . 

In the event of an abort condition, the abort relay is disengaged, disconnecting the drive amplifier from the servo 
valve and leaving the servo valve control coil as the inductive element in a passive RLC circuit. The resulting RLC 
circuit results in a exponentially decaying servo valve current, thus limiting leg acceleration when transitioning from 
the pre aborted command velocity to the zero command velocity of the aborted leg. The RC circuit values were 
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chosen to work with the inductance (L) of the servo valve such that the servo valve current will approach zero with a 
time constant of approximately 150 milliseconds. This RC circuit is not in the feedback path of the valve’s current 
amplifier and does not distort the engaged valve drive current. Figure 10 shows the valve current decay of an abort 
relay measured during integration testing of the servo electronics. 

Upon power failure or ESTOP, the electronic system aborts using the abort relay while the hydraulic system 
simultaneously performs a hydraulic abort. In the hydraulic abort, settle valves remove the hydraulic authority from 
the servo valves controlling each actuator. The settle valves also apply system pressure to the rod end of the actuator 
and switch a pressure compensated flow restrictor into the hydraulic return path. This hydraulic abort causes the rod 
to retract under the control of the flow restrictor which maintains a constant retraction rate under varying load 
conditions. Since the moving hardware of an electrical abort involves one electrical relay while the moving 
hardware of the hydraulic abort involves an electrical relay followed by two stages of shifting hydraulic spools, the 
abort relay design was completed assuming the electrical abort would begin to act and potentially complete before 
the hydraulic abort was initiated. 



Time (s) 

Figure 10 A plot of the abort relay disengage obtained during integration testing. 


2. Abort Relay Test Method 

The abort relay was first observed by monitoring the servo valve drive current during ESTOP events. The 
characteristic decay shown in Figure 10 was observed on paper strip charts of recorded servo valve currents during 
initial motion testing. All twelve valves (two per actuator) were monitored during ESTOP tests to check for the Isv 
decay curves. In later tests the measured valve current was digitally recorded using the DVS 4 system along with the 
actuator velocity. An analysis of the valve current and actuator velocity, acceleration and pressure allowed a 
determination of the abort relay performance and of the relative timing of the electronic abort and the hydraulic 
abort. Figure 1 1 shows the valve current and measured velocity, acceleration and pressure during an ESTOP which 
was triggered with the actuator moving at 25ips. 

The valve current and actuator velocity shown in the top plot of the Figure 11 demonstrate the characteristic 
abort relay decay starting at time zero. At 100 milliseconds, the hydraulic abort takes over and the velocity becomes 
disassociated with the valve current and is controlled solely by the hydraulic settle valves. At that time, the hydraulic 
system is removing authority from the servo valve by switching the system pressure to the rod end of the actuator 
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through two parallel hydraulic settle valves. Once the hydraulic authority is removed from the servo valve, the valve 
current no longer has an effect on the actuator velocity. 

The second plot in Figure 11 shows the acceleration during the abort sequence. The initial part of the 
acceleration curve shows the acceleration induced by the electronic abort. As in the case of the velocity plot, 100 
milliseconds into the abort the acceleration becomes a function of the hydraulic abort and is no longer affected by 
the servo valve or its electronics. This shows that the acceleration of the electronic abort is limited to approximately 
one half of a G, while the acceleration due to the hydraulic abort is approximately 1.5 Gs. 

The third plot of Figure 11 shows pressure in the rod end of the actuator during the abort sequence. Again, the 
initial 100 milliseconds of the abort is driven by the electronic abort, and the rod pressure change is closely related 
to the change in valve current. After 100 milliseconds the hydraulic abort takes over as the settle valve shifts to 
remove the hydraulic authority of the servo valve and apply the supply side accumulator pressure to the rod end of 
the actuator. With the settle valve shifted, and the accumulator pressure routed to the rod end of the actuator, the rod 
is forced to retract. The retract rate is controlled by flow restrictors switched into the hydraulic return path by the 
settle valve. 


Isv and Leg Velocity vs. Time 



Isv and Acceleration vs. Time 



Isv and Rod Pressure vs. Time 



Figure 11 Abort Relay Performance 


3. Abort Relay Future Tests/Changes 

The timing of the hydraulic abort was not known when the abort circuit was designed. The electronic abort was 
designed assuming that it would have time to act prior to the initiation of the hydraulic abort. Now that the relative 
timing of the hydraulic abort is known, the trade off between velocity removed via the electronic abort and velocity 
remaining at the start of the hydraulic abort can be revisited. The peak acceleration shown in Figure 11 can be 
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reduced by making the abort relay more aggressive so that less velocity remains when the hydraulic abort takes over. 
Since the dynamics of the abort will also change with the addition of the payload, the abort performance will be 
assessed with the payload. The electronic abort timing will be adjusted to minimize peak acceleration by removing 
as much velocity as possible with the relatively smoothly decelerated electronic abort prior to the initiation of the 
hydraulic abort. 


IV. Conclusion 

Early load modeling analysis of the CMF motion base showed that the manufacturer’s design hydraulic cushions 
alone would not be enough to completely slow the actuator before the end of stroke while fully loaded. The velocity 
clamp circuitry was developed to reduce the leg’s velocity as it neared the end of travel. Data collected during the 
no-load testing verifies that the circuit works as intended, yet we will not know its final performance until the 
system is tested under a full load condition. The rate limiter circuitry was implemented to mitigate excessive 
accelerations stemming from application of erroneous or aggressive commands that step a servo valve or instantly 
reverse servo direction. The data collected verifies that the rate limiter circuit is able to effectively control these high 
acceleration events. The servo engage / abort relay circuitry was designed to limit the leg’s acceleration when 
transitioning from the current commanded velocity to a zero commanded velocity of an aborted leg. The data 
obtained during testing verifies that the RC circuit chosen works with the inductance (L) of the servo valve to cause 
the servo valve command to approach zero with a time constant of approximately 150 milliseconds fall time. Testing 
has identified the relative timing of the electronic and hydraulic abort sequences. Knowing this timing will allow 
future adjustments to achieve an improved trade off between velocity removed due to electronic or hydraulic abort. 
The testing and adjustment of these safety systems will be repeated using a test weight which simulates the mass and 
inertia of a simulator cab. Finally, the addition of velocity sensors has provided a system improvement of directly 
measured velocity over the previously position derived velocity and has opened the door for future control 
improvements using velocity feedback. 
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